---
id: CVE-2026-118947
title: >-
  Keycloak-services: keycloak-services: authorization bypass via uma resource
  registration idor
summary: >-
  A flaw was found in the UMA resource registration endpoint of the
  keycloak-services component, which provides the core logic for Keycloak's
  authorization and identity services. The issue occurs when remote resource
  management is enabled,…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-639
vendor: Red Hat
product: keycloak-services
affected:
  - keycloak-services (all versions)
  - rhbk/keycloak-rhel9 (all versions)
  - keycloak-services
published: '2026-10-30'
updated: '2026-10-30'
sourceUpdated: '2026-10-30T00:13:56.153Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-118947'
references:
  - url: 'https://access.redhat.com/security/cve/CVE-2026-118947'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2563274'
    label: RHBZ#2563274
tags:
  - cve.org
epss: 0.00198
epssPercentile: 0.09594
ingestedAt: '2026-11-03T09:40:52.162Z'
---

## Overview

A flaw was found in the UMA resource registration endpoint of the keycloak-services component, which provides the core logic for Keycloak's authorization and identity services. The issue occurs when remote resource management is enabled, allowing an authenticated user with specific permissions to update resources they do not own by providing a target resource ID in a request. This can lead to unauthorized modification of resource configurations, such as names, URIs, and scopes.

## Affected

- `keycloak-services (all versions)`
- `rhbk/keycloak-rhel9 (all versions)`
- `keycloak-services`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.